İCO. 


Information Commissioner's Office 


ICO call for views on a direct marketing code 
of practice 


The Information Commissioner is calling for views on a direct 
marketing code of practice. 


The Data Protection Act 2018 requires the Commissioner to produce 
a code of practice that provides practical guidance and promotes 
good practice in regard to direct marketing. 


While direct marketing is an important and useful tool to help 
organisations engage with people in order to grow their business or 
to publicise and gain support for their causes, it can also be 
intrusive and have a negative impact on people if done badly. This 
can cause reputational damage to organisations and, in some cases, 
result in fines or other regulatory action for breaking data protection 
laws. 


So it is important that organisations ensure their marketing 
activities are compliant with data protection legislation (the General 
Data Protection Regulation and Data Protection Act 2018) and, 
where necessary, the Privacy and Electronic Communications 
Regulations 2003 (PECR). 


We have previously published detailed direct marketing guidance. 
The new code will build on that guidance and address the aspects of 
the new legislation relevant to direct marketing such as 
transparency and lawful bases for processing, as well as covering 
the rules on electronic marketing (for example emails, text 
messages, phone calls) under PECR. 


The European Union is in the process of replacing the current e- 
privacy law (and therefore PECR) with a new ePrivacy Regulation 
(ePR). However the new ePR is yet to be agreed and there is no 
certainty about what the final rules will be. Because of this we 
intend for the direct marketing code to only cover the current PECR 
rules until the ePR is agreed. Once the ePR is finalised and the UK 
position in relation to it is clear we will produce an updated version 
of the code which takes this into account as appropriate. 


This call for views is the first stage of the consultation process. The 
Commissioner is seeking input from relevant stakeholders, including 
trade associations, data subjects and those representing the 
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interests of data subjects. We will use the responses we receive to 
inform our work in developing the code. 


You can email your response to directmarketingcode@ico.org.uk 
Or print and post to: 


Direct Marketing Code Call for Views 
Engagement Department 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the call for views, please 
email the Direct Marketing Code team. 


Please send us your views by 24 December 2018. 


Privacy statement 


For this call for views we will publish responses received from 
organisations but will remove any personal data before publication. 
We will not publish responses from individuals. For more 
information about what we do with personal data please see our 


privacy notice. 
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uestions 


Q1 The code will address the changes in data protection 
legislation and the implications for direct marketing. What 
changes to the data protection legislation do you think we 
should focus on in the direct marketing code? 


There is a general need for guidance on any provisions of the new 
law which the ICO considers to be relevant to direct marketing, 
regardless as to the medium through which that direct marketing 
might be carried out. 


Q2 Apart from the recent changes to data protection legislation 
are there other developments that are having an impact on 
your organisation's direct marketing practices that you think 
we should address in the code? 


L] yes 
C] No 


Q3 If yes please specify 


The development of new technology and communications 
platforms and channels continues to move at rapid pace. The UK 
is, of course, at the forefront of technological innovation. 
Paragraph 36 of the existing ICO guidance on direct marketing 
explains that the definition of ‘direct marketing’ covers any means 
of communication, is not limited to traditional forms of marketing, 
and can extend to online marketing, social networking or other 
emerging channels of communication. Detailed guidance on how 
the law applies to these innovative methods of communication 
from a direct marketing perspective would be very useful. 


Q4 Weare planning to produce the code before the draft ePrivacy 
Regulation (ePR) is agreed. We will then produce a revised 
code once the ePR becomes law. Do you agree with this 
approach? 


LI ves 
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| ] No 


Q5 If no please explain why you disagree 


İCO. 


Information Canimlssioncrs Office 


Although it seems sensible to produce the code before the 
ePrivacy Regulation is agreed because the date for its 
implementation is currently unknown, we would point out the very 
serious implications for businesses if the text of the Regulation 
necessitates material changes to the code and to business 
practices. 


Q6 Is the content of the ICO’s existing direct marketing guidance 
relevant to the marketing that your organisation is involved 
in? 


[L] yes 
[ ] No 


Q7 If no what additional areas would you like to see covered? 


Please see our response to Q3. 


Q8 Isit easy to find information in our existing direct marketing 
guidance? 


[L] ves 
| ] No 


Q9 If no, do you have any suggestions on how we should 
structure the direct marketing code? 


Although the existing guidance is easy to use, it needs to be 
updated (via the code) to reflect changes in technology (again 
please see our response to Q3). In particular, examples/case 
studies are very useful. 
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® 
1cO. 
Q10 Please provide details of any case studies or marketing ail 
scenarios that you would like to see included in the direct 


marketing code. 


It would be useful to provide further guidance/case 
studies on: 


(i) what level of evidence is required for having obtained 
direct marketing consent or established a legitimate 
interest ground (as the case may be) for processing. 
There is some confusion that the more evidence 
organisations have to retain in order to be able to 
demonstrate compliance, the less likely they are to 
comply with the data minimization principle; 


(ii) how the legitimate interest ground under the GDPR 
with regard to processing personal data, interacts with 
the consent requirement under PECR to physically 
send direct marketing messaging. There is some 
confusion over the requirement, for example, to 
justify processing connected to direct marketing (e.g. 
data analysis or matching) under the basis of 
legitimate interests on the one hand, and on consent 
for the purposes of sending the electronic 
communication on the other. 


Q11 Do you have any other suggestions for the direct marketing 
code? 


Guidance would be useful on whether the ICO considers that the 
recently implemented Geo-blocking Regulation (EU) 

2018/302 would have implications for direct marketing and, if so, 
what those implications might be. 


About you 


Q12 Are you answering these questions as? 
[|_| A public sector worker 

[| | A private sector worker 

| | A third or voluntary sector worker 
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A member of the public 

A representative of a trade association 
A data subject 

An ICO employee 

Other 


OOOO 


If you answered ‘other’ please specify: 


İCO. 


Information Commissioners Office 


Q13 Please provide the name of the organisation that you are 
representing. 


The Institute of Practitioners in Advertising 


Q14 We may want to contact you about some of the points you 
have raised. If you are happy for us to do this please provide 
your email address: 


Thank you for taking the time to share your views and experience. 
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